Alphabet just made one of the biggest bets in the history of cybersecurity.

Maybe all of tech.

Yesterday was an industry-defining day. You'll remember where you were and what you were doing the day you found out Alphabet acquired Wiz.¹

It was the day cybersecurity's future veered in a radically different direction.

As Alphabet's founders famously said in a shareholder letter 21 years ago, "Google is not a conventional company. We do not intend to become one."

It takes one to know one.

Wiz is anything but a conventional cybersecurity company — which, ironically, led Alphabet to make the most unconventional acquisition in its history.

Just like that, the spectacular rise of Wiz as an independent company appears to be over. It's changing course and continuing the ride aboard a blue, red, yellow, and green-colored rocketship.

And I have so many questions about what all of this means.

Let's start by talking about how massive this deal was in economic terms, then work our way through the strategic and competitive impact.²

Just how big of a deal was this, really?

Short answer: one of the largest deals in history across almost any measure.

This deal is basically in a class of its own — definitely in cybersecurity, and arguably across all of tech.

Alphabet is buying Wiz for one of the highest (disclosed) revenue multiples in the history of large cybersecurity M&A.

Wiz falls somewhere between a 45-65x revenue multiple based on current estimates. Their most recent public disclosure was $500 million of ARR. Sources said their current ARR is closer to $700 million. They were reportedly on track for $1 billion later this year.

This is how Wiz's multiple compares to a selection of other high-profile deals in cybersecurity:

There's only one other cybersecurity-related transaction with a relatively similar profile: Okta's acquisition of Auth0 in 2021.

I say relatively similar because Wiz's ARR is much higher than Auth0 had at the time of acquisition, among other reasons. The Okta-Auth0 deal had a 42.7x revenue multiple, which is easily the highest among large ($2.5B+) cybersecurity acquisitions that have actually closed.

But Auth0's revenue was much smaller when they were acquired. Okta was also a much smaller acquirer. They're a big company, but nowhere near the scale of Alphabet.

The story doesn't end there, though.

Alphabet's proposed acquisition price for Wiz had among the highest dollar values and revenue multiples we've ever seen in the entire software industry.

Here's a look at the most relevant comps for software M&A³:

WhatsApp is the undisputed champion of the world for billion-dollar-plus M&A revenue multiples. Meta (then Facebook) paid $17.2 billion for ~$30 million of revenue (according to PitchBook, reportedly lower in other sources). That's a ~573x revenue multiple!

It's a consumer app with a completely different business model, though. I only included this example to show how high the ceiling can go with a motivated strategic buyer.

The Adobe-Figma deal (RIP) is a more accurate comp (even though it didn't close) because it has a similar size and narrative to Alphabet-Wiz. Mainly: it costs a lot of money to buy a market-leading growth company in its prime. A 50x multiple in the case of Figma. Wiz is right around the valuation Adobe was willing to pay for Figma.

The rest of this chart looks like a hall of fame for software industry M&A — large B2B acquisitions that mostly turned out well.

Microsoft-GitHub is a good example because revenue was relatively similar at the time of purchase. GitHub is now a $1B+ business unit for Microsoft.

SAP-Qualtrics also had similar revenue scale. The acquisition didn't last, but it was still a fairly good outcome. Qualtrics was spun off as a public company and later taken private again for $12.5B.

Alphabet is paying a lot for Wiz, but deals like this aren't completely unheard of. Buying one of the top startups in cybersecurity is expensive, and paying top dollar is what it takes to make a deal like this happen.

Why is Wiz worth so much to Alphabet?

To answer why Wiz is worth $32 billion to Alphabet, we need to look at a trillion-dollar question⁴: What will it take to win the public cloud infrastructure market?

This is the problem at hand for Alphabet and Google Cloud today:

They're the number three cloud provider by market share, hovering around 10% for years at a $48 billion annual run rate. AWS is over double the size of Google Cloud. You know Alphabet doesn't like losing to Microsoft, either.

Wiz is a big part of Alphabet's answer for how they're going to beat AWS and Microsoft. Not the only part, but a big one.

This was a deeply calculated move.

Alphabet didn’t rush out to acquire a competitor. They clearly wanted Wiz.

Sure, there are other cloud security products in the market — including some built by private companies who, on the surface, would have been logical and cheaper acquisition targets.

But there really is no substitute for Wiz.

Buying Wiz is about more than just a cloud security product. It’s a brand. A mystique. A promise. A chance to reinvent Google Cloud and transform it into the cloud infrastructure market leader.

Wiz is the combined cybersecurity and cloud infrastructure market aspirations of Alphabet, all rolled into a bright and shiny $32 billion package.

You have to look way beyond Alphabet's cybersecurity acquisitions to get a true appreciation for the magnitude and strategic importance of Wiz.

Alphabet has done big deals before, with eight other acquisitions over $1 billion. The list includes one other cybersecurity company with their $5.3 billion purchase of Mandiant in 2022:

Cybersecurity is such a big priority for Alphabet that the acquisition price for Wiz is more than $3 billion more than their eight other largest acquisitions combined.

Alphabet acquired Motorola Mobility for $9.6 billion in 2011, which was a high stakes move to solidify their lead in the smartphone market and add in-house hardware manufacturing capabilities. Devices are a huge priority, and the acquisition price for Wiz is $22.4 billion (or 3.3x) higher than Alphabet paid for Motorola Mobility.

Sundar Pichai called Alphabet's shot on investing in cybersecurity years ago. Here's one example from a 2021 earnings call:

"[Cybersecurity] is definitely an area where we are seeing a lot of conversations, a lot of interest. It's our strongest product portfolio, and we are continuing to enhance our solutions...a definite source of strength, and you'll continue to see us invest here."

It's one thing to say cybersecurity is strategic. It's another to back it up with over $40 billion in cybersecurity-related acquisitions and billions more in R&D.

Alphabet has been steadily building their cybersecurity portfolio ever since, both organically and inorganically.

It's a classic Jim Collins "bullets and cannonballs" concept. Fire bullets to figure out what will work. Once you have validation, fire a cannonball (a big bet):

Alphabet has been firing bullets in cybersecurity for a few years now. They have some empirical validation with Chronicle and Mandiant. Wiz is the cannonball.

An expensive cannonball, no doubt — but well-calibrated cannonballs are the way big companies get outsized results.

The results depend on exactly how well calibrated the cannonball is.

The base case is Alphabet building a strong, relatively standalone cybersecurity business within Google Cloud. They already have a promising security operations business. Adding Wiz is rocket fuel. The base case alone could make Alphabet's cybersecurity investments look brilliant.

The bull case is Alphabet's cybersecurity business driving meaningful market adoption of Google Cloud. It's the answer to the trillion-dollar question. It's Wiz's ticket to ride.

In a trillion-dollar cloud infrastructure game, Alphabet is willing to buy a cybersecurity market leader while it's still private no matter what it costs.

Alphabet simply wasn't willing to take "no" for an answer. Not for the company they so clearly wanted.

Tuck-in acquisitions alone weren't going to get the job done. Audacious moves are part of the territory, and that’s exactly what we saw happen here.

The full answer to the trillion-dollar question is a complex, multi-part strategy, of course — but becoming the cybersecurity leader among public cloud infrastructure providers is one of the best shots Alphabet has at winning the market.⁵

Why did Wiz decide to sell this time?

As they say, everyone has a number. I'm sure their reasoning is a lot more nuanced, but price is one of the main factors that changed between last July and today.

$23 billion is a lot to begin with, but $9 billion more is a big deal. Wiz sold for 39.1% higher just by waiting this out for nine months.

Marc Andreessen was still probably pounding the table yelling at the founders not to sell (like he famously and successfully did to Mark Zuckerberg at Facebook), but the reality is this was too much money for Wiz and its other investors to turn down. He'll get over it once the wire hits a16z's bank account.

Another major factor that changed was CrowdStrike. The Wall Street Journal reported Alphabet's offer to buy Wiz on July 14, 2024 — the beginning of a fateful week in cybersecurity industry history.

CrowdStrike caused a massive IT outage five days later. Wiz declined Alphabet's offer shortly after, partly due to the opportunity presented by CrowdStrike's uncertain future during a time where their situation looked dire.

Nine months later, CrowdStrike has ostensibly put the incident behind them. They look stronger than ever as a company with no meaningful decline in financial performance from the incident.

That's not to say Wiz isn't competitive against CrowdStrike in cloud security — just that the path to victory looks a lot better without CrowdStrike.

The third major factor is the state of public markets and the IPO window. The good news is that we have an IPO window in the first place. SailPoint went public already. Wiz was at the top of the list of remaining candidates in the pipeline.

The bad news is markets have been unstable so far in 2025. The S&P 500 is down 8.6% in the past month. Ironically, the market is almost exactly where it was when this whole saga started in July 2024.

Wiz almost certainly would have been the largest cybersecurity IPO in history...but could they have topped a $32 billion valuation? I don't think so, at least not right away.

They still had the option to keep going and wait things out — but again, everyone has a number. I don't blame them for taking $32 billion to the bank now over a much longer and less certain path to...someday, maybe...topping $32 billion the hard way.

I called this cybersecurity's "Zuckerberg moment" the first time around. As it turns out, it was more like cybersecurity's Instagram moment instead — a high-profile exit with a reasonable chance at a "better together" story.

Is this acquisition going to get past regulatory approval?

Yes, I think it will. Other than CrowdStrike, a hostile regulatory environment for M&A was the other reason the Alphabet-Wiz deal fell apart the first time around.

There are still questions about the new administration's stance on M&A with the HP-Juniper acquisition being held up, but this one looks a lot different.

It’s easier to make a monopoly argument in an old-ish industry segment like secure networking and a transaction oriented around market share between large, established players.

I don’t know how a regulator could argue against there being intense competition in the cloud security market, even with Alphabet owning Wiz.

Regulatory approval certainly isn't a slam dunk. It's going to face intense scrutiny, lobbying by competitors, and probably delays. But the probable outcome is a close sometime in 2025 or early 2026.

What does this mean for Alphabet and Wiz going forward?

This could be a whole article in itself, so I'm going to focus on two things: corporate strategy and retention.

Alphabet buying Wiz means they are pot committed to seeing their cybersecurity strategy through. As wild as it sounds, that wasn't the case before acquiring Wiz. Not even after spending $4.5 billion on Mandiant.

Mandiant is a rounding error for a company like Alphabet. They can afford Wiz, but you can bet they're going to put their full resources behind making this acquisition successful once it closes.

Perhaps ironically, I suspect this means more acquisitions. Who, what, and when are a separate discussion — I'm just saying they have now proven they're willing to do whatever it takes to be a major cybersecurity player now.

Retention of Wiz's amazingly talented team is a central pillar of this strategy actually working in practice. Wiz is Wiz because they have one of the best teams ever assembled across every aspect of their business — product, engineering, GTM, you name it. The longer they can keep Wiz's execution functioning at a high level, the better this deal is going to look.

...but they're probably going to have a hard time retaining the team. Founders and key employees are easy enough — they have lockup periods, earnouts, and other incentives in deals like this. Alphabet kept the Mandiant team as long as they could, but it's been slowly trickling away across all levels.

Wiz is going to end up being one of cybersecurity's biggest and best mafias. We're probably going to see multiple successful companies founded by Wiz alumni in the next five years, and multiple more funded by the wealth this exit just created.

Builders gonna build, and there is only so much Alphabet can do about that.

What does this mean for customers?

Let me tell you what it doesn't mean: mass defection of Wiz's existing customers to competitors.

We've seen different versions of this movie before — some major event happens, FUD takes over, and lots of people speculate about mass defection of customers and the end of times for the company.

That's not going to happen, especially if Alphabet plays its cards right and successfully positions Wiz as a standalone, multi-cloud security product.

Are some customers going to have concerns about Wiz being owned by Google Cloud and churn out? Of course. Those are edge cases, not a majority.

Just because there are grumblings and paranoia about the nefarious things Alphabet might do with Wiz doesn't mean customers are going to pick up and leave. Imagine going to your CFO (after already pounding the table to buy Wiz) and saying you want a new cloud security product now because of...reasons.

Get out of my office.

The base reality for enterprises today is a multi-cloud, multi-vendor existence. If they're already using Wiz and love it, which a lot of people do, they're not going anywhere.

Back to the execution and retention points: this changes years later if Wiz can't maintain the pace and quality of execution its pre-acquistion customers expect. We're years away from that. The near-term customer impact is going to be minimal.

What does this mean for competitors?

It's a mixed bag, but Wiz being acquired is more good than bad news for competitors. Especially their pure-play cybersecurity competitors.

Wiz no longer being an independent company eliminates one of the biggest threats (the SWOT definition of threat, that is) for larger cybersecurity competitors like Palo Alto Networks and CrowdStrike. Yes, there was and will continue to be competition at the product level in cloud security. That's fine.

The big competitive win here is Wiz not becoming a large public company and continuing to grow its platform. Wiz is still going keep building its platform, but in a different, Google Cloud-oriented way than it would have as a standalone company.

The gap between the large, multi-domain cybersecurity companies and everyone else looks a whole lot wider without Wiz.

The news isn't quite as good for Google Cloud's competitors in the public cloud infrastructure market.

AWS and Microsoft have to take Google Cloud more seriously. It's not like Alphabet was totally off the radar before they bought Wiz, though. The competition is still going to be intense across multiple fronts — especially in AI, and now in cybersecurity.

But remember, Google Cloud is still sitting at number three. There's a long, arduous journey between announcing a major acquisition like Wiz and becoming the number one cloud provider.

The biggest implication I hope we'll see as an industry is AWS and Microsoft taking their cybersecurity businesses more seriously. I don't expect this will set off a major acquisition spree by either company, but it does raise the competitive bar in a meaningful way.

What does this mean for partners?

Cybersecurity partnerships have complex dynamics. The impact really depends on the type of partnership, incentives, competitive positioning, and many other factors.

One major theme I do have conviction about: we're not going to see a mass defection of partners from either Google Cloud or Wiz.

There is some risk to Wiz itself on the partner side. Roughly 50-60% of their revenue goes through marketplaces. Assuming this revenue is roughly distributed by cloud infrastructure market share, only ~10% of it is coming from Google Cloud. Having ~90% of your marketplace revenue in flux is a big risk, but it's definitely not insurmountable.

As we discussed in the last section, this move has the biggest impact on AWS and Microsoft, Google Cloud's direct competitors in the cloud infrastructure market. They're obviously going to be more paranoid and less forthcoming about product roadmaps and collaborations with Wiz.

They're not going to kick Wiz out of their marketplaces or take any other drastic action, though. They might want to, but other parties affect their decisions.

Limiting customer choice isn't a good look with regulators already scrutinizing their broader business practices. More importantly, if customers want to buy Wiz, it's foolish not to let them. AWS and Microsoft will happily take their cut of Wiz's revenue and keep their own cloud infrastructure customers happy.

Don't expect them to help out on the GTM side, though. Any boost Wiz got from AWS and Microsoft sales teams is effectively over. Alphabet obviously knew this and was willing to absorb the hit.

Most other channel and technology partners are going to start taking their Google Cloud partnerships a lot more seriously. This was already trending up, but acquiring Wiz accelerates partner effort and investment.

Large cybersecurity GSIs were already taking Google Cloud seriously based on their recent traction in the SIEM market. But, believe it or not, they weren't all that serious about Wiz yet. GSIs are deeply skeptical of startups, and it was hard to know with certainty whether Wiz was a passing fad or the next big thing in cybersecurity.

Google Cloud owning Wiz is the best possible scenario in the eyes of a GSI. They already have multi-billion dollar partnerships with Google Cloud. The acquisition gives them enough certainty that Wiz is here to stay. It slides in nicely as another large cybersecurity service offering to build under the Google Cloud alliance.

I expect status quo for most other technology partners post-acquisition. Cybersecurity already exists in a state of co-opetition, with many competing companies and products begrudgingly integrating with each other to meet shared customer needs.

The Check Point and Cisco partnerships that were recently announced are probably the most unique and impactful technology partnership changes from the acquisition.

Cisco looks like the least impacted of the two. They generally have a co-opetition relationship with Google Cloud, so they may decide to proceed as planned. But, this also increases the probability they decide to enter the CNAPP market and acquire one of Wiz's competitors.

Check Point has a bigger strategic decision on their hands — and not an ideal one for the first major partnership of the Nadav Zafrir era. They were set to migrate customers from its CloudGuard CNAPP platform to Wiz under the terms of this partnership. That may still happen, but they may also rethink their situation and take another look at build and buy scenarios to stay in the CNAPP market.

What does this mean for the industry?

Wiz exiting feels bittersweet. It's a good outcome, but I worry about the long-term implications on the industry side.

Putting one of the largest exits in the history of tech on the board is a big win for the cybersecurity industry at large. It's de facto validation for everything we've been doing and the importance of cybersecurity in the broader tech landscape.

An acquisition this large also makes it (more) okay for other large strategic buyers to pay high multiples for cybersecurity market leaders. A lot of this is driven by comps, and this completely resets the benchmark during a time where more large exits are needed.

Wiz is unique in so many ways, though. The size and scale of its exit doesn't automatically mean we're going to see other cybersecurity unicorns attracting the same level of interest and capital. It doesn't hurt, though.

On the other hand, Wiz was almost certainly going to be cybersecurity's largest ever IPO. $32 billion looks good in the near-term, but we'll never know what would have happened if Wiz had a sustained run as an independent company.

It sure looked like Wiz had a shot at reaching a $100B+ valuation someday. Now, we'll never know.

I keep wondering if cybersecurity has a glass ceiling we haven't fully recognized yet.

Early stage market leaders are being acquired early. IPOs are a meaningful milestone, but even reaching public markets is no guarantee a company will stay there.

Wiz being acquired is a visceral reminder that very few standalone cybersecurity companies are untouchable. Two, to be exact: Palo Alto Networks and CrowdStrike. Anyone else is up for grabs at any time.

Wiz might have hit the glass ceiling on the 100th floor, but it was still there.

Larger tech industry dynamics were at play here. Nothing is off limits when trillion-dollar questions are hanging over the heads of the largest and most powerful companies in the world.

Remember: cybersecurity is a pawn in a much larger game of chess.

Footnotes

¹I know, I know: Alphabet announced their intent to acquire Wiz. We'll get to the "will this actually close" question later in the article.

²I wrote this article as fast as I could. I stopped counting how many cups of coffee I drank. I'm sure I missed a lot of details and potential considerations. Please cut me some slack in the spirit of moving fast :)

³This data isn't a banker-level comp set, so don't make any serious decisions from it. I just wanted to give you some context on where the valuation for this potential deal stands against recent history.

⁴Trillion-dollar question is a favorite a16z phrase for big questions with significant industry and market impact.

⁵The other is AI, which is another trillion-dollar question. This tells us a lot about how high the stakes are for Alphabet. They're facing multiple trillion-dollar questions at the same time.